Skip to content

Commit 71268ef

Browse files
steph-torres-nhsNogaNHS
steph-torres-nhs
and
NogaNHS
authored
[PRMP-892] Add Staging S3 Bucket as an Origin to the CloudFront Distribution (#527)
Signed-off-by: NogaNHS <[email protected]> Co-authored-by: NogaNHS <[email protected]>
1 parent 69a65bd commit 71268ef

17 files changed

+209
-346
lines changed

‎infrastructure/buckets.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ module "ndr-lloyd-george-store" {
5151
access_logs_enabled = local.is_production
5252
access_logs_bucket_id = local.access_logs_bucket_id
5353
cloudfront_enabled = true
54-
cloudfront_arn = module.cloudfront-distribution-lg.cloudfront_arn
54+
cloudfront_arn = aws_cloudfront_distribution.s3_presign_mask.arn
5555
bucket_name = var.lloyd_george_bucket_name
5656
enable_bucket_versioning = true
5757
environment = var.environment
@@ -122,6 +122,8 @@ module "ndr-bulk-staging-store" {
122122
bucket_name = var.staging_store_bucket_name
123123
enable_cors_configuration = true
124124
enable_bucket_versioning = true
125+
cloudfront_arn = aws_cloudfront_distribution.s3_presign_mask.arn
126+
cloudfront_enabled = true
125127
environment = var.environment
126128
owner = var.owner
127129
force_destroy = local.is_force_destroy
@@ -167,7 +169,7 @@ module "ndr-document-pending-review-store" {
167169
enable_bucket_versioning = true
168170
force_destroy = local.is_force_destroy
169171
cloudfront_enabled = true
170-
cloudfront_arn = module.cloudfront-distribution-lg.cloudfront_arn
172+
cloudfront_arn = aws_cloudfront_distribution.s3_presign_mask.arn
171173
enable_cors_configuration = true
172174
cors_rules = [
173175
{

‎infrastructure/cloudfront.tf‎

Lines changed: 146 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
locals {
2+
# required by USA-based CI pipeline runners to run smoke tests
3+
allow_us_comms = !local.is_production
4+
}
5+
6+
resource "aws_cloudfront_origin_access_control" "s3" {
7+
name = "${terraform.workspace}_cloudfront_s3_oac_policy"
8+
description = "CloudFront S3 OAC"
9+
origin_access_control_origin_type = "s3"
10+
signing_behavior = "never"
11+
signing_protocol = "sigv4"
12+
}
13+
114
module "cloudfront_firewall_waf_v2" {
215
source = "./modules/firewall_waf_v2"
316
cloudfront_acl = true
@@ -8,16 +21,136 @@ module "cloudfront_firewall_waf_v2" {
821
providers = { aws = aws.us_east_1 }
922
}
1023

11-
module "cloudfront-distribution-lg" {
12-
source = "./modules/cloudfront"
13-
bucket_domain_name = module.ndr-lloyd-george-store.bucket_regional_domain_name
14-
bucket_id = module.ndr-lloyd-george-store.bucket_id
15-
qualifed_arn = module.edge-presign-lambda.qualified_arn
16-
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name, module.ndr-document-pending-review-store.bucket_id, module.ndr-document-pending-review-store.bucket_domain_name]
17-
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
18-
has_secondary_bucket = local.is_production ? false : true
19-
secondary_bucket_domain_name = module.ndr-document-pending-review-store.bucket_regional_domain_name
20-
secondary_bucket_id = module.ndr-document-pending-review-store.bucket_id
21-
secondary_bucket_path_pattern = "/review/*"
22-
log_bucket_id = local.access_logs_bucket_id
23-
}
24+
resource "aws_cloudfront_distribution" "s3_presign_mask" {
25+
price_class = "PriceClass_100"
26+
27+
origin {
28+
domain_name = module.ndr-lloyd-george-store.bucket_regional_domain_name
29+
origin_id = module.ndr-lloyd-george-store.bucket_id
30+
origin_access_control_id = aws_cloudfront_origin_access_control.s3.id
31+
}
32+
enabled = true
33+
is_ipv6_enabled = true
34+
35+
default_cache_behavior {
36+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
37+
cached_methods = ["HEAD", "GET", "OPTIONS"]
38+
target_origin_id = module.ndr-lloyd-george-store.bucket_id
39+
viewer_protocol_policy = "redirect-to-https"
40+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
41+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer.id
42+
43+
lambda_function_association {
44+
event_type = "origin-request"
45+
lambda_arn = module.edge-presign-lambda.qualified_arn
46+
}
47+
}
48+
49+
origin {
50+
domain_name = module.ndr-document-pending-review-store.bucket_regional_domain_name
51+
origin_id = module.ndr-document-pending-review-store.bucket_id
52+
origin_access_control_id = aws_cloudfront_origin_access_control.s3.id
53+
}
54+
55+
ordered_cache_behavior {
56+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
57+
cached_methods = ["HEAD", "GET", "OPTIONS"]
58+
path_pattern = "/review/*"
59+
target_origin_id = module.ndr-document-pending-review-store.bucket_id
60+
viewer_protocol_policy = "redirect-to-https"
61+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
62+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer.id
63+
64+
lambda_function_association {
65+
event_type = "origin-request"
66+
lambda_arn = module.edge-presign-lambda.qualified_arn
67+
}
68+
}
69+
70+
origin {
71+
domain_name = module.ndr-bulk-staging-store.bucket_regional_domain_name
72+
origin_id = module.ndr-bulk-staging-store.bucket_id
73+
origin_access_control_id = aws_cloudfront_origin_access_control.s3.id
74+
}
75+
76+
ordered_cache_behavior {
77+
allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
78+
cached_methods = ["HEAD", "GET", "OPTIONS"]
79+
path_pattern = "/upload/*"
80+
target_origin_id = module.ndr-bulk-staging-store.bucket_id
81+
viewer_protocol_policy = "redirect-to-https"
82+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
83+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer.id
84+
85+
lambda_function_association {
86+
event_type = "origin-request"
87+
lambda_arn = module.edge-presign-lambda.qualified_arn
88+
}
89+
}
90+
91+
viewer_certificate {
92+
cloudfront_default_certificate = true
93+
}
94+
95+
restrictions {
96+
geo_restriction {
97+
restriction_type = "whitelist"
98+
locations = local.allow_us_comms ? ["GB", "US"] : ["GB"]
99+
}
100+
}
101+
102+
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
103+
}
104+
105+
resource "aws_cloudfront_origin_request_policy" "viewer" {
106+
name = "${terraform.workspace}_BlockQueriesAndAllowViewer"
107+
108+
query_strings_config {
109+
query_string_behavior = "whitelist"
110+
query_strings {
111+
items = [
112+
"X-Amz-Algorithm",
113+
"X-Amz-Credential",
114+
"X-Amz-Date",
115+
"X-Amz-Expires",
116+
"X-Amz-SignedHeaders",
117+
"X-Amz-Signature",
118+
"X-Amz-Security-Token"
119+
]
120+
}
121+
}
122+
123+
headers_config {
124+
header_behavior = "whitelist"
125+
headers {
126+
items = [
127+
"Host",
128+
"CloudFront-Viewer-Country",
129+
"X-Forwarded-For"
130+
]
131+
}
132+
}
133+
134+
cookies_config {
135+
cookie_behavior = "none"
136+
}
137+
}
138+
139+
resource "aws_cloudfront_cache_policy" "nocache" {
140+
name = "${terraform.workspace}_nocache_policy"
141+
default_ttl = 0
142+
max_ttl = 0
143+
min_ttl = 0
144+
145+
parameters_in_cache_key_and_forwarded_to_origin {
146+
cookies_config {
147+
cookie_behavior = "none"
148+
}
149+
headers_config {
150+
header_behavior = "none"
151+
}
152+
query_strings_config {
153+
query_string_behavior = "none"
154+
}
155+
}
156+
}

‎infrastructure/iam.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,8 @@ data "aws_iam_policy_document" "assume_role_policy_for_get_doc_ref_lambda" {
142142
type = "AWS"
143143
identifiers = [
144144
module.get-doc-fhir-lambda.lambda_execution_role_arn,
145-
module.get-doc-ref-lambda.lambda_execution_role_arn
145+
module.get-doc-ref-lambda.lambda_execution_role_arn,
146+
module.post_document_review_lambda.lambda_execution_role_arn
146147
]
147148
}
148149
}

‎infrastructure/lambda-edge-presign.tf‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,34 @@ module "edge-presign-lambda" {
7373
iam_role_policies = [
7474
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
7575
aws_iam_policy.ssm_access_policy.arn,
76-
module.ndr-app-config.app_config_policy_arn
76+
module.ndr-app-config.app_config_policy_arn,
77+
aws_iam_policy.staging_bucket_put.arn
7778
]
7879
providers = {
7980
aws = aws.us_east_1
8081
}
81-
bucket_names = [module.ndr-lloyd-george-store.bucket_id, module.ndr-document-pending-review-store.bucket_id]
82-
table_name = module.cloudfront_edge_dynamodb_table.table_name
83-
}
82+
bucket_names = [
83+
module.ndr-lloyd-george-store.bucket_id,
84+
module.ndr-document-pending-review-store.bucket_id,
85+
module.ndr-bulk-staging-store.bucket_id
86+
]
87+
table_name = module.cloudfront_edge_dynamodb_table.table_name
88+
}
89+
90+
resource "aws_iam_policy" "staging_bucket_put" {
91+
name = "${terraform.workspace}_staging_bucket_put"
92+
policy = jsonencode({
93+
Version = "2012-10-17",
94+
Statement = [
95+
{
96+
Effect = "Allow",
97+
Action = [
98+
"s3:PutObject"
99+
],
100+
Resource = [
101+
"${module.ndr-bulk-staging-store.bucket_arn}/*",
102+
]
103+
}
104+
]
105+
})
106+
}

‎infrastructure/lambda-get-doc-ref.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,10 @@ module "get-doc-ref-lambda" {
6464
WORKSPACE = terraform.workspace
6565
PRESIGNED_ASSUME_ROLE = aws_iam_role.get_doc_ref_presign_url_role.arn
6666
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
67-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
67+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
6868
}
6969
depends_on = [
7070
aws_api_gateway_rest_api.ndr_doc_store_api,
71-
module.cloudfront-distribution-lg,
7271
module.document_reference_id_gateway
7372
]
7473
}

‎infrastructure/lambda-get-document-fhir.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ module "get-doc-fhir-lambda" {
6060
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
6161
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
6262
OIDC_CALLBACK_URL = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
63-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
63+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
6464
PDS_FHIR_IS_STUBBED = local.is_sandbox
6565
}
6666
depends_on = [

‎infrastructure/lambda-get-document-review.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,13 @@ module "get_document_review_lambda" {
2424
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
2525
DOCUMENT_REVIEW_DYNAMODB_NAME = module.document_upload_review_dynamodb_table.table_name
2626
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
27-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
27+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
2828
PRESIGNED_ASSUME_ROLE = aws_iam_role.get_document_review_presign.arn
2929
WORKSPACE = terraform.workspace
3030
}
3131
depends_on = [
3232
aws_api_gateway_rest_api.ndr_doc_store_api,
3333
module.review_document_version_gateway,
34-
module.cloudfront-distribution-lg
3534
]
3635
}
3736

‎infrastructure/lambda-lloyd-george-record-stitch.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ module "lloyd-george-stitch-lambda" {
7878
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
7979
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
8080
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.stitch_metadata_dynamodb_table_name}"
81-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
81+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
8282
WORKSPACE = terraform.workspace
8383
PRESIGNED_ASSUME_ROLE = aws_iam_role.stitch_presign_url_role.arn
8484
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
@@ -88,7 +88,6 @@ module "lloyd-george-stitch-lambda" {
8888
module.ndr-lloyd-george-store,
8989
module.lloyd-george-stitch-gateway,
9090
module.ndr-app-config,
91-
module.cloudfront-distribution-lg,
9291
module.stitch_metadata_reference_dynamodb_table,
9392
module.lloyd_george_reference_dynamodb_table
9493
]

‎infrastructure/lambda-post-document-review.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ module "post_document_review_lambda" {
2727
WORKSPACE = terraform.workspace
2828
STAGING_STORE_BUCKET_NAME = module.ndr-bulk-staging-store.bucket_id
2929
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
30+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
3031
}
3132
depends_on = [
3233
aws_api_gateway_rest_api.ndr_doc_store_api,

‎infrastructure/modules/cloudfront/README.md‎

Lines changed: 0 additions & 70 deletions
This file was deleted.

0 commit comments

Comments
 (0)